For When You Can't Have The Real Thing
[ start | index | login ]
start > Linux > arpwatch


Created by dave. Last edited by dave, 10 years and 56 days ago. Viewed 3,404 times. #3
[diff] [history] [edit] [rdf]


I am running arpwatch-2.1a13-10.RHEL4, obtained with CentOS 4.5 (a re-spin of RHEL 4.5).

I am trying to include two additional networks to monitor, in addition to the default local network.

I am invoking arpwatch as so:

arpwatch -i eth0 -u pcap -e my@email.address -s root (Arpwatch) -n a.b.c.d/25 -n e.f.g.h/27

However, arpwatch is still reporting bogons in e.f.g.h/27:

Apr 24 10:46:56 saturn arpwatch: bogon e.f.g.139 0:a0:cc:d3:2f:b2
Apr 24 10:47:48 saturn arpwatch: bogon e.f.g.132 0:f:66:4f:15:25
Apr 24 10:47:52 saturn arpwatch: bogon e.f.g.136 0:4:5a:8a:25:54
Apr 24 10:50:59 saturn arpwatch: bogon e.f.g.136 0:4:5a:8a:25:54
I have tried a couple of alternative invocations, specifically
  • […] –n a.b.c.d/25 e.f.g.h/27
  • […] –n a.b.c.d/25,e.f.g.h/27
…but arpwatch does not start with the parameters written like this.

The man page is perhaps ambiguous when describing –n: The -n flag specifies additional local networks.

It implies that more than one additional network can be specified but does not elaborate on how this might be accomplished.

no comments | post comment
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.

Useful: | Copyright 2000-2002 Matthias L. Jugel and Stephan J. Schmidt